A UI misrepresentation flaw in GitHub Enterprise Server allowed an OAuth application to request the manage_runners:org scope without it appearing on the authorization consent screen. An attacker can create such an OAuth app, entice a victim user to authorize it, and thereby gain unrestricted control over the victim’s organization runners. This enables the attacker to add, modify, or delete runners, potentially leading to malicious workflow execution within the organization’s GitHub Actions environment.

GitHub Enterprise Server versions prior to 3.22 are affected. The issue was addressed in release 3.21.2 for 3.21.x, 3.20.4 for 3.20.x, 3.19.8 for 3.19.x, 3.18.11 for 3.18.x, and 3.17.17 for 3.17.x.

The CVSS score of 4.8 indicates moderate severity. EPSS data is unavailable, and the vulnerability is not listed in the CISA KEV catalog. The attack requires a human victim to authorize a malicious OAuth application, making the threat vector social engineering. While it does not grant immediate code execution, the ability to manage runners can be leveraged to run arbitrary code in the organization’s CI/CD pipeline, which is a significant risk when combined with other vulnerabilities.